General
-
Target
1c30e5420d07219610e04bca768ced5e_JaffaCakes118
-
Size
295KB
-
Sample
240506-m6hbzshg9x
-
MD5
1c30e5420d07219610e04bca768ced5e
-
SHA1
4a15cc924dcbcf33f4ff4a74865128efbbf49883
-
SHA256
9fb0bbfedfcc264a83a8968fce7e9a64df16000921602794f9a68ecb7e4f8783
-
SHA512
7b42d1806a9d7b5c16f5d01eaa08074724de68bbe051152eb2650c6ad1b3eb8596579aecb50e351a6d727b90e12019a730b884a5888f3cfb426e7844a0ba0458
-
SSDEEP
3072:qdxNL9U7b6jLeizuRFr6FBkcw4s/EyN1OpbQPCSs8Afw6SIBIHQx0duXrSFhCemJ:6USjLeiKr6FBkpqdQk3SC0QUjbDchfV
Malware Config
Targets
-
-
Target
1c30e5420d07219610e04bca768ced5e_JaffaCakes118
-
Size
295KB
-
MD5
1c30e5420d07219610e04bca768ced5e
-
SHA1
4a15cc924dcbcf33f4ff4a74865128efbbf49883
-
SHA256
9fb0bbfedfcc264a83a8968fce7e9a64df16000921602794f9a68ecb7e4f8783
-
SHA512
7b42d1806a9d7b5c16f5d01eaa08074724de68bbe051152eb2650c6ad1b3eb8596579aecb50e351a6d727b90e12019a730b884a5888f3cfb426e7844a0ba0458
-
SSDEEP
3072:qdxNL9U7b6jLeizuRFr6FBkcw4s/EyN1OpbQPCSs8Afw6SIBIHQx0duXrSFhCemJ:6USjLeiKr6FBkpqdQk3SC0QUjbDchfV
Score10/10-
Taurus Stealer
Taurus is an infostealer first seen in June 2020.
-
Taurus Stealer payload
-
Deletes itself
-
Reads WinSCP keys stored on the system
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-